If registrars were the only valid CA for a domain and clients could somehow validate this, then we'd remove the "insecure SMTP" from the equation. Also I would

If registrars were the only valid CA for a domain and clients could somehow validate this, then we'd remove the "insecure SMTP" from the equation. Also I wouldn't mind people thinking twice about the implications of using .ly and others as their home on the internet. Why shouldn't geopolitical TLDs mean something? It would allow end users to make a more informed decision on trusting a particular website, more than today's system. We would still allow multiple registars for both generic TLDs and national TLDs. And Google could very well implement a blacklist for registrars that have turned out to be mischievous, similar to the safe browsing service they already have. Or the TLD operators could kick out the unserious registrars from their TLD registry. And domain registrants would shun unserious registrars like crazy if google started blacklisting particular registrars. Edit: To clarify, a "registrar" is not a TLD operator but one of many companies with access to the TLD database, taking domain registrations on behalf of the TLD. I think it's important that TLDs still delegate registration to multiple independent, approved registrars like it is today. Edit2: Today, you are trusting: (#1.) that the registrar or TLD operator or root zone operator doesn't fool around with your NS records or they could redirect SSL purchases to themselves for your domain and (#2.) that not a single CA in the world produces an improper certificate for your domain regardless of #1. With my suggestion, you no longer need to trust #2, but you still need to trust #1. Which is better than today's situation.